CVE-2026-92128

Executive Summary

CVE-2026-92128 is a code-execution vulnerability in the Jenkins Script Security Plugin affecting version 1415.v9a_f9b_3a_c253d and earlier. The plugin downloads a JAR file from an attacker-supplied URL twice: the first download is submitted for approval, while the second download's classpath entries are actually loaded. This TOCTOU-style mismatch lets an actor who can influence classpath entries have unapproved bytecode loaded and executed inside the Jenkins controller JVM. With a CVSS base score of 7.5 and low privileges required, successful exploitation yields full compromise of the controller — including credential and job-secret exposure — though the High attack complexity and absent public exploit code reduce immediate opportunistic risk.

Technical Analysis

CVE-2026-92128 maps to CWE-494 (Download of Code Without Integrity Check) and, more precisely, describes a time-of-check-to-time-of-use (TOCTOU) integrity failure inside the Jenkins Script Security Plugin. Per the NVD description, the plugin "downloads a JAR file specified by URL twice." The first fetch is the artifact that is presented for the Script Security approval workflow; the second fetch is the artifact whose classpath entries are subsequently loaded into the controller JVM. Because the two retrievals are not bound to the same immutable content (e.g., no captured hash/ETag pinning of the approved bytes), an attacker who controls or can mutate the URL's returned content can cause the approved-looking download and the actually-loaded download to differ.

The trust boundary being crossed is the Script Security Plugin's sandbox and approval mechanism. Script Security exists specifically to prevent unapproved Groovy/Java code from executing on the Jenkins controller. Here, the approval decision is made against the content of the first download, but execution consumes the second download. Any party able to "define classpath entries" — that is, to influence which URL(s) the plugin resolves as classpath dependencies — can therefore place arbitrary code into the controller's classpath. Once a class is loaded and invoked from that classpath, the code runs with the privileges of the Jenkins controller JVM, not within any restricted sandbox.

Two technical prerequisites follow directly from the description. First, the attacker must be able to define or influence classpath entries (this is the privilege/authorization gate). Second, the attacker must be able to serve content that is not byte-for-byte identical across the two retrievals — a classic race/second-fetch substitution that can be realized by a URL under attacker control returning different content on the second request, or by mutating the resource between the two downloads. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) is consistent with this reading: network reachability, high complexity (the double-download race/mismatch must be won), low privileges required, no user interaction, and high confidentiality, integrity, and availability impact confined to the single vulnerable component (Scope: Unchanged, since the impact stays within the Jenkins controller context). The NVD description does not name specific plugin classes, methods, or HTTP endpoints, so no implementation-level identifiers beyond those stated should be assumed.

Exploitation Scenarios

No public proof-of-concept exists for this CVE; the following chain is inferred strictly from the vulnerability class (CWE-494 TOCTOU on a downloaded JAR) and the NVD description. Only concepts named in the description are used.

1. Reconnaissance / target identification. The attacker identifies a reachable Jenkins controller running Script Security Plugin 1415.v9a_f9b_3a_c253d or earlier. This is the exposed attack surface (AV:N). Consistent with PR:L, the actor is assumed to already hold a low-privileged authenticated context, or otherwise to be able to influence configuration in which classpath entries are defined.

2. Triggering the flaw. The attacker arranges for a URL they can control or mutate to be used as a classpath entry / JAR source processed by the Script Security workflow. Because the plugin downloads the JAR twice — once for approval, once for loading — the attacker serves benign, approvable content on the first retrieval and different content on the second. The approval step sees the harmless artifact; the classpath-loading step consumes the substituted artifact. This defeats the approval control, which is the core TOCTOU integrity failure (CWE-494).

3. Payload / execution. The second download's classpath entries are loaded, and the injected classes execute "in the context of the Jenkins controller JVM," as stated in the description. This is the point at which arbitrary code execution is achieved — the payload runs unsandboxed on the controller, having bypassed the Script Security approval gate.

4. Post-exploitation impact. Because execution occurs in the controller JVM, the attacker reaches anything the controller can access within the same scope: confidentiality, integrity, and availability impacts are all High (C:H/I:H/A:H) with Scope Unchanged (impact confined to the vulnerable component). Practically, that means control over the Jenkins controller's runtime — including the data and operations the controller manages — with no further user interaction (UI:N) required.

Impact Assessment

The blast radius is the Jenkins controller itself, which is the central trust authority for a Jenkins deployment. CVSS 3.1 base 7.5 with subscores AV:N (remotely reachable), AC:H (the attacker must win the double-download mismatch — exploitation is not trivial), PR:L (a low-privileged position suffices), UI:N (no victim interaction), S:U (contained to the controller component), and C:H/I:H/A:H. Business impact concentrates on the controller as a high-value target: it holds job definitions, build orchestration, and the credentials/secrets used by pipelines, so controller-level code execution is a serious integrity and confidentiality event. Availability is also at risk because the code runs inside the controller JVM, where crashes or resource abuse can disrupt all pipelines. Mitigating factors for near-term risk: no CISA KEV listing, no public exploit code, no Nuclei template, and EPSS not yet scored. Caveat: the unknown affected-version enumeration and absent vendor confirmation mean asset owners should verify their exact plugin version before assuming exposure.

Detection Guidance

Sigma Rule

Detects Script Security approval activity followed by unexpected class/JAR loading behavior observable in Jenkins logs. Tune field names to your Jenkins audit-log schema.

title: Jenkins Script Security Potential JAR Double-Download Approval Bypass (CVE-2026-92128)
id: 9f2c7a1e-2b6d-4e5a-9c3f-00000092128
status: experimental
description: Detects Script Security approval of a URL-sourced JAR followed by classpath/JAR loading, consistent with a TOCTOU approval bypass on Jenkins Script Security Plugin.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92128
author: valtersit.com
date: 2026/01/01
logsource:
  product: jenkins
  service: script-security
detection:
  selection_approval:
    message|contains:
      - "ScriptApproval"
      - "approv"
      - "classpath"
  selection_download:
    message|contains:
      - ".jar"
      - "downloading"
      - "http://"
      - "https://"
  condition: selection_approval and selection_download
fields:
  - user
  - url
  - message
falsepositives:
  - Legitimate plugin/administrator activity approving JAR dependencies
level: high

YARA Rule

Scans for JARs containing classpath/manifest metadata that reference remote HTTP(S) URLs — the class of artifact involved in the double-download classpath-loading abuse described in the CVE.

rule CVE_2026_92128_Jenkins_Remote_Classpath_JAR
{
    meta:
        description = "Detects JAR archives whose manifest/classpath references remote URLs, relevant to Jenkins Script Security Plugin double-download classpath loading (CVE-2026-92128)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92128"
        date = "2026-01-01"
        severity = "high"

    strings:
        $manifest = "META-INF/MANIFEST.MF" ascii
        $cp       = "Class-Path:" ascii nocase
        $http     = "http://" ascii
        $https    = "https://" ascii
        $jar      = ".jar" ascii

    condition:
        $manifest and $cp and ($http or $https) and $jar
}

Suricata IDS Rule

Flags repeated HTTP retrieval of the same .jar URL in a short window — the network signature of a two-stage download substitution. Adjust the SID and timing threshold to your environment.

alert http any any -> any any (msg:"CVE-2026-92128 Jenkins Script Security Double JAR Download Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:".jar"; nocase; threshold:type both, track by_src, count 2, seconds 10; classtype:attempted-admin; reference:cve,2026-92128; sid:9021128; rev:1;)

Elastic Detection

Correlates repeated JVM/JAR classloading events from the Jenkins process within a tight window, which can surface classpath substitution activity.

sequence by host.id, process.entity_id with maxspan=10s
  [ process where process.name : "java" and process.args : "*jenkins*" ]
  [ file where event.action == "creation" and file.extension == "jar" ]
  [ process where process.name : "java" and process.args : ("*classpath*" or "*Class-Path*") ]

Splunk SPL Query

Surfaces Jenkins controllers that approve a JAR/URL and then promptly load JAR content, ranked by host and URL for triage.

index=jenkins sourcetype=jenkins:*
| search ("ScriptApproval" OR "approv*") ("classpath" OR ".jar" OR "http://" OR "https://")
| stats count min(_time) as firstTime max(_time) as lastTime values(message) as msgs by host, url
| where count >= 2
| convert ctime(firstTime) ctime(lastTime)
| sort - count

Wazuh OSSEC Rule

Detects post-approval JAR/classpath loading activity in Jenkins logs; tune the program_name and regex to your log pipeline.

<group name="jenkins,cve-2026-92128,">
  <rule id="100228" level="12">
    <if_sid>100200</if_sid>
    <program_name>jenkins</program_name>
    <regex>ScriptApproval|approv.*classpath|downloading.*\.jar|http[s]?://.*\.jar</regex>
    <description>CVE-2026-92128: Possible Jenkins Script Security JAR double-download approval bypass (classpath loading)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version enumeration was provided in the supplied data, and the OSV package mapping is unavailable. Treat this as an open risk until Jenkins publishes an advisory.

1. Immediate mitigations

• Restrict who can define classpath entries and who can approve Script Security requests; apply least privilege to any role that can influence JAR/classpath sources (the PR:L gate in the CVSS vector).
• Where feasible, block egress from the Jenkins controller to untrusted hosts, and disallow remote HTTP(S) JAR sources for classpath entries; pin dependencies to vetted, internally hosted, immutable artifacts.
• Verify the installed Script Security Plugin version against the affected range (1415.v9a_f9b_3a_c253d and earlier) and inventory any controller that uses URL-defined classpath entries.
• Monitor Jenkins audit/log output for repeated retrieval of the same JAR URL and for approval events that are immediately followed by JAR/classpath loading (see Detection Guidance).

2. Patch / upgrade steps

• Monitor the Jenkins security advisories and the Script Security Plugin release feed for a fixed version. No patch reference exists yet (patch confidence 0/4); do not assume any version is safe.
• When a fix is released, upgrade the Script Security Plugin through the Jenkins Update Center, or via a pinned plugin version in your configuration-as-code/image build, then restart the controller and re-validate.

3. Long-term hardening

• Enforce integrity verification (hash/allowlist) for any JAR/artifact introduced into the controller classpath so that approval and loading operate on identical, immutable content — directly addressing the CWE-494 TOCTOU condition.
• Adopt a hardened Jenkins baseline: minimize plugin surface, restrict admin/approval roles, keep controllers out of directly exposed network segments, and monitor for controller-JVM code execution indicators.
• Track this CVE in your vulnerability-management workflow and re-check patch status regularly until vendor confirmation is available.

References

• NVD — CVE-2026-92128: https://nvd.nist.gov/vuln/detail/CVE-2026-92128
• MITRE CWE-494 (Download of Code Without Integrity Check): https://cwe.mitre.org/data/definitions/494.html
• Jenkins Security Advisories (monitor for the Script Security Plugin advisory): https://www.jenkins.io/security/advisories/
• Jenkins Script Security Plugin documentation: https://plugins.jenkins.io/script-security/
• CISA Known Exploited Vulnerabilities Catalog (currently NOT listed as of reporting): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild note: No CISA KEV entry, no public PoC, no exploit code, and no Nuclei template were provided. There is no evidence of active exploitation or named threat-actor campaigns in the supplied data; treat any such claim as unverified.